Never tried this before. A SessionFactory object is responsible for a particular database, so in your case, you'll have 2 SessionFactory objects to deal with. Using programmatic configuration, you can load your mapping files one by one (with the Configuration object), and then obtain a session factory.

If SF1 depends on mappings declared in SF2 (Service depends on Product), maybe building SF1 programmatically and loading both Product.hbm.xml and Service.hbm.xml would do the trick, assuming the database managed by SF1 has the corresponding synonyms to access the tables in the database managed by SF2.